topic Splunk on AWS EC2 in Deployment Architecture

Splunk on AWS EC2

garfieldconnoll — Fri, 10 Sep 2010 02:23:59 GMT

Hi,

We're working with Splunk on Amazon's EC2 service (Ubuntu).

At the moment we're working off a standard instance, at 10cent per hour.

I was going to upgrade to a high CPU medium instance, at 20cent per hour.

With AWS' announcement today regarding micro instances, I was wondering.....

"Am I better with 1 high CPU medium instance, 2 standard instances, or 10 micro instances?"

Okay, so there's a strong "string L=N, derive N" element to the question. But if I had to choose a route, any suggestions?

Re: Splunk on AWS EC2

gkanapathy — Fri, 10 Sep 2010 03:55:35 GMT

When in AWS, I would recommend scaling using units of the High-CPU XL instances. It seems like you need less capacity than this, but of the choices, I am pretty sure the 10 micro instances will be unsuitable and clumsy for a typical Splunk workload. I think the Standard Small is also too small, even with two of them, as you are limited to just one core per machine. Between the Standard Large and the High-CPU Large, I might go with the High-CPU, unless you plan to store you indexes on the instance rather than on EBS, in which case the additional space on the Standard might count for more.

Re: Splunk on AWS EC2

garfieldconnoll — Fri, 10 Sep 2010 05:19:56 GMT

Thanks for that. I'd +1 the post, but I don't have permission yet. We don't have a lot of data, but may have a disproportionate number of users for the amount of indexed data. Apologies if I have the 'wrong end of the stick' on that.

Regards,

Re: Splunk on AWS EC2

garfieldconnoll — Tue, 21 Sep 2010 02:36:41 GMT

Able to thank gkanapathy's response now, so doing so!